Hot answers tagged

109

From a security perspective, you need to revalidate everything on the server. This will always be the case, no matter how pretty and advanced HTML5 features become. You simply can not trust the client. You have no idea if it will follow the HTML5 rules or not. You don't even know if it is a browser. So should you validate the whole form with your own JS ...


55

In theory, if all servers and connections to them were perfectly secure (impossible) and trustworthy (not true), neither one would be more "secure" than the other - mainly because the developer(s) of the website are in full control of the content of the site. Since Flash and the JS is served to clients, the server would have to serve malicious content to the ...


45

I just checked this with my VPN in http://html5demos.com/geo Although I VPN through Germany, it still shows my nearby location in London. If you read https://www.mozilla.org/en-US/firefox/geolocation/ , you will see: If you consent, Firefox gathers information about nearby wireless access points and your computer’s IP address Then Firefox sends this ...


32

In addition to WillS' excellent answer, a couple more differences that affect security: Flash is a product, while HTML5/Javascript is a specification. With a product (and especially a closed-source one), you always depend on the vendor to play a game of whack-a-mole (which Adobe is doing admirably, but long term it is a losing battle). A specification can ...


28

A popup was used to show the alert. Does this mean that the popup feature introduces vulnerabilities? Then by that line of reasoning JavaScript is the source of all problems. There are people who actually think that JS is an important vector for attacks and block it on untrusted websites with extensions like NoScript. Many features can be misused, and is ...


20

At least the author wrote a rather clear page on how his encryption works. Notwithstanding, this looks like a rather old-style homemade stream cipher, which is not good news, since most of such systems have been thoroughly broken. It appears to consist of a basic LFSR subsystem (two LFSR with key-dependent polynomials; the bit about the polynomials operating ...


20

A VPN masks your IP address. But the HTML5 geolocation API isn't based on your IP address. It is a Javascript API which can be used to ask the web browser directly where it thinks it is located according to whatever information is available to it (system locale settings, nearby wifi networks, GPS sensors, IP address of the network interfaces as you see them ...


16

The W3C security instructions for this are surprisingly accurate and complete: Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, bugs in the author's message handling code could be exploited by hostile sites. Furthermore, even after checking the ...


14

An explanation with code and screenshots The answers given are great. But I wanted to illustrate this with some code/screenshots. The bottom line is that anything client side can be manipulated (disabled/completely got rid of/bypassed or modified) by the end-user. So any sort of "client side validation" is totally useless from a security perspective. You ...


13

Try disabling HTML5 geolocation if you don't use it. In Firefox, set geo.enabled to false in about:config. There have been bugs, and there will be again, example 1 and example 2.


12

Pros It can improve security when authenticating (in addition to a multi-factor device) If used as a "client certificate", it can make MITM attacks much more difficult The Keygen tag is implemented across most non-IE browsers, making it very easy to implement Works regardless of administrator permission. With IE Active X controls can be disabled and IE and ...


11

In principle, values stored in sessionStorage are restricted to the same scheme + hostname + unique port, and if the browser has a clean exit these values should be deleted at the end of the session. However, according to this post it can survive a browser restart if the user chooses to "restore the session" after a crash (which means its values also exist ...


11

Actually, this has nothing to do with moving CryptoCat to a browser plugin/extension. It's not even related to SSL at all. Having that in mind, Stephen's answer is somewhat misleading. I'll attempt to address that. CryptoCat is still JavaScript & HTML. Give me your full attention, assume that SSL is doing its job and you're 100% sure that you're ...


10

HTTPS is still an absolute requirement, and Matasano's main point is that JavaScript can never replace HTTPS. A MITM attack could deliver a custom JavaScript payload that could read any secrets in localstorage, and an XSS payload could also compromise this data. Matasano is wrong in regards to random number generators in JavaScript. Most browsers provide ...


9

The obvious usage is client authentication. It can be used to improve security in combination with a passphrase or smartcard, or to be a convenient replacement for entering a password. The WebID single sign on protocol is an interesting proposal in this context. The main issue with client certificates is that it is bound to the browser. So if you are on ...


9

In this post in the chromium forum there are alternatives mentioned Within the browser space, alternatives exist such as: Use the device's native management capabilities if an enterprise use case. On Windows, this is Group Policy. On iOS/Android, this is the mobile device management suites. On OS X, this is Enterprise settings. On ChromeOS, ...


8

Firefox From Firefox 52, the battery API has been disabled and is only available to chrome/privileged code (I would assume add-ons fall into this category). For earlier versions, the battery API is enabled by default. It can be disabled by going to to about:config and setting the dom.battery.enabled to false. Changes take effect immediately on subsequent ...


8

JSON_HEX_TAG If you are echoing into JS inside a HTML document (as you are in your example), this is necesarry or you risk opening up a huge XSS vulnerability. Without this one, an attacker can post something along the lines of this: </script>alert("XSS");</script> Since PHP 5.4 this has been fixed, and slashes are escaped by default, but ...


8

Well, you can do it using the MutationObserver API. const inputPasswordElements = document.querySelectorAll('input[type=password]'); const observer = new MutationObserver(function (mutations) { mutations.forEach(function (mutation) { if (mutation.type === 'attributes' && mutation.attributeName === 'type') { mutation.target....


7

Local storage is a relatively new feature available to web applications, but some kind of 'industry standards' or best practices have already appeared. OWASP HTML5 cheat sheet considering your case states that: Underlying storage mechanism may vary from one user agent to the next. In other words, any authentication your application requires can be ...


7

The issues are mostly the same as for secure software development in general. Note that the most critical issue for secure software development is (1) integrating security into your software development lifecycle (so security is integrated into each step of the process: design, implementation, maintenance, ops), and (2) training of developers. It is a ...


7

EME doesn't "allow" proprietary code, that's a misinformation of Wikipedia based on this four years old post , a post which does not provide real information, just the assumption that at some point a full DRM solution will be integrated into the browser. The EME is just an API to interact with the license server and the Content Decryption Module. This CDM ...


7

Yes, in the past there have been lots of exploits that only relied on malicious HTML and CSS code. You are right in that parsing a complex, turing-complete language is potentially more error-prone, giving an attacker more tools to craft an exploit. Yet, there are many different ways in which the implementation of the used CSS parser or other modules ...


7

Why is it limited to JS and CSS resources? But, why is it only limited to JS and CSS files? The W3C SRI specification states: The scheme specified here also applies to link and future versions of this specification are likely to expand this coverage. It also states: A future revision of this specification is likely to include integrity support for ...


7

What exactly would that image request URL look like? It need not be anything complicated or abnormal. There are two main ways this could work (were it not for the restrictions in the browser): In the first, there is a specific URL for the profile image of the current user, say http://mydatingsite.com/currentuser/profileimage.jpg. This might be an odd way ...


6

1) How can I recommend a text field be secured (as far as validating input prior to be accepted to the html parser (which I learned runs before any of the other parsers))? See https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet for information on how to prevent cross-site scripting (XSS). You will need to do data validation ...


6

I suggest another approach: Instead of submitting the form to the server, use an XMLHttpRequest to create the account. If server side validation fails, the form and all its content is still available. If it was successful, redirect to the target page. This requires that JavaScript is enabled, but you still can fall back to normal form submission. Access to ...


6

You will be having hard time deciding on which of the two stored values to use as the user's intended password (the one in the local storage, or the one in the input field), if none of them are empty but for some reason differ. This can potentially provide for a social engineering attack vector, where the attacker prepares a trap by opening the registration ...


6

In short; A browser restart. However, not every browser implements the specification defined by the W3C the same way. a) Does anyone have any knowledge on how the Tier 1 open source browsers (Firefox, Chromium) handle the sessionStorage and whether the contents could be written to disk, even temporarily in the case of a browser crash? It makes no ...


Only top voted, non community-wiki answers of a minimum length are eligible